Malicious code in incom-css (npm)
Summary
MAL-2024-2508: Malicious code in incom-css (npm). Affects incom-css versions 1.0.7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The incom-css package is an npm package used for handling CSS incompatibilities. It provides functionality to detect and resolve CSS compatibility issues across different browsers and platforms. The package is widely used in web development projects to ensure consistent rendering of CSS styles. However, a vulnerability has been discovered in the incom-css package that allows the execution of malicious code.
Vulnerability Detail
The vulnerability in incom-css (npm) is due to the presence of malicious code within the package. This code can be triggered when the package is used in a vulnerable environment, potentially leading to unauthorized access, data breaches, or other malicious activities. The malicious code can exploit vulnerabilities in the underlying system or inject additional malicious payloads. It is important to update the package to a non-malicious version to mitigate the risk.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall incom-cssIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The incom-css package has been found to contain malicious code, posing a security risk to projects utilizing this package. It is crucial to update the package to a non-malicious version, such as version 1.0.8 or later, to mitigate the vulnerability. Failure to do so may result in unauthorized access, data breaches, or other malicious activities.
See every vulnerability recorded for incom-css →
FAQ
incom-css is an npm package used for handling CSS incompatibilities in web development projects.
The vulnerability allows the execution of malicious code, potentially leading to unauthorized access, data breaches, or other malicious activities.
To fix the vulnerability, update the incom-css package to a non-malicious version, such as version 1.0.8 or later.
No specific workarounds have been provided. It is recommended to update the package to a non-malicious version.
More information about the vulnerability can be found in the GitHub repository of the malicious-packages project: https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/incom-css/MAL-2024-2508.json
